Passwordless: a different kind of hell?
Modern authentication is caught between growing security threats and increasingly painful user experiences. Commenters trade stories of multi-step logins, short session timeouts, forced 2FA, and “magic links” that turn simple tasks like buying something or opening notes into multi-minute rituals, while noting that banks and platforms often use this friction to shift liability onto users. Many see passkeys, hardware tokens, and better standards as promising, but remain skeptical that passwordless schemes and biometrics will actually reduce complexity or avoid new lock‑in and recovery nightmares.
Scope of the discussion
- Thread quickly broadens from “passwordless hell” to: crime and “bad actors”, 2FA sprawl, session timeouts, passkeys/biometrics, hardware keys, and usability/accessibility concerns.
- Many comments argue the core problem is not passwords but how security is bolted on and inconsistently implemented.
Crime, “bad actors,” and why we “can’t have nice things”
- One camp blames thieves and “bad actors” for escalating security and surveillance; some even advocate extremely harsh punishments and permanent exclusion.
- Another camp stresses root causes: poverty, inequality, social policy (healthcare, drugs, education), and loss of social cohesion.
- Disagreement over data and examples (e.g., Sweden’s welfare state yet high crime).
- Consensus only that some protection is necessary, but whether to focus on punishment vs prevention is contested.
Passwords, 2FA, and usability friction
- Many say average users choose terrible passwords and refuse password managers, forcing sites toward 2FA, SMS codes, and “passwordless” flows.
- Others argue banks and platforms offload fraud risk onto users: 2FA and PINs become excuses to deny refunds.
- Strong frustration with multi-step ecommerce flows (eBay → PayPal → bank app → 3DS), magic links that break on email delays, and involuntary 2FA enablement.
- Regulatory drivers (EU PSD2 / Strong Customer Authentication, 3DS) are cited as sources of friction.
Sessions, resets, and security value
- Debate over very short session lifetimes: some see them as pointless UX damage for little security gain; others note specific contexts (healthcare, shared machines).
- Concerns that many services let you reset passwords/2FA instantly via email, sometimes without invalidating existing sessions or adding cooldowns.
Passkeys, biometrics, and hardware keys
- Several expected a deeper critique of passkeys; instead, they appear mostly as “future maybe-better” with open questions: device loss, cross-device use, ecosystem lock‑in.
- Biometrics:
- Pro side: convenient, secure-enough when stored locally in secure enclaves and used as a gate to strong secrets.
- Skeptic side: spoofable, non‑revocable, often treated as security when they’re really convenience.
- Hardware keys (U2F/WebAuthn) praised as phishing-resistant, but backups, device loss, limited credential slots, and management overhead are real barriers.
Accessibility, older users, and lockouts
- Complex auth flows and passwordless schemes (e.g., Notion’s constant email codes) are seen as nearly impossible for older people, cognitively impaired users, or those with limited tech literacy.
- Multiple horror stories of account lockouts due to lost phones/MFA, recovery codes, or forced 2FA with weak recovery paths (e.g., GitHub, Amazon, Google).
Calls for better design and standards
- Desire for:
- Consistent, well-defined standards for passwords, MFA, recovery, and risk-based challenges.
- More user agency to pick security level (e.g., opt-out of 2FA for low-stakes accounts).
- Long-lived, low-friction sessions for low-risk actions, with stronger checks only for high‑risk changes.